Microsoft will not pay bounties to bug hunters

Powered by SC Magazine
 

Declines to follow Mozilla and Google.

Unlike its peers, Microsoft will not pay security researchers a reward for bringing bugs to its attention.

Google and Mozilla have both increased their bounties this month, each offering approximately £2,000 ($3,447) for alerts about the most critical flaws.

In a blog post released this week, Microsoft said that it regularly tackles questions about whether it should pay rewards when people point them out to it, but explained that it chooses to reward them in non-monetary ways.

"At Microsoft we recognise, and appreciate, the unique value that security researchers play in identifying issues and helping the entire computing ecosystem improve from a security perspective," the firm said, before skirting the cash question with the suggestion that it compensates these researchers in other ways.

"Throughout the years we've seen researchers saying that, if vendors really valued their work, we'd compensate them directly for the vulnerabilities they discover. That's a trend that's continued in recent weeks. We absolutely value the researcher ecosystem, and show that in a variety of ways."

There is an argument that the firm could not afford to pay out on all the bugs that people report to it. And indeed, the team posted about the sheer weight of emails it gets on the subject.

The Microsoft Security Response Center (MSRC) receives more than 100,000 email messages per year, according to the post. That is roughly 275 a day or 11 an hour. Although some of these will be found to be unproved, the team explained that it filters these reports down to 1,000 investigations a year.

One of the ways that Microsoft rewards the security community is through events, and indeed it is a sponsor of the Black Hat security conference.

In the run up to the event, which takes place next week in Las Vegas, the MSRC team reflected on the way it manages bug alerts and deals with them.

Reacting, in advance, to criticisms that the firm is slow to react to problems, whether self-discovered or alerted to them, the team noted: "Some will say that we take too long to fix our vulnerabilities. But it isn't all about time-to-fix.

"Our chief priority with respect to security updates is to minimise disruption to our customers and to help protect them from online criminal attackers."

Rather than commit to a timeline for solving issues, Microsoft prefers to take its time studying them, and making sure that they are the root, and not a result of, a problem.

"Many times the issue that the finder reported is an indication of other similar vulnerabilities in that area of code. And the original issue may not be the most complicated, or even the most likely to get used in attacks," the firm said.

"Microsoft tries to address vulnerabilities and all of their variants in as few updates as possible because they cost enterprise customers time, effort and money to re-assess and deploy multiple updates for issues that could potentially be addressed in a single update."

Working in this way saves Microsoft customers from applying multiple patches to fix what is actually just one issue.

"The time it takes to complete a comprehensive examination helps to ensure the number of security updates Microsoft releases and needs to re-release is kept to a minimum, thus reducing the costs and potential disruption to enterprise customers' operations," it added.

For the main part, Microsoft's security team takes every effort to release patches before gaps are exploited, and also before the vulnerability is publicised.

Copyright ©v3.co.uk


Microsoft will not pay bounties to bug hunters
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Microsoft Office is now free for some charities
Oct 10, 2014
Microsoft has announced that eligible Australian non-profit organisations and charities can now ...
Vodafone lights up 4G in Adelaide
Oct 9, 2014
Live and work in Adelaide? Vodafone has switched on its 4G network in the city and suburbs.
Next year tradies will be able to take payments using ingogo
Oct 3, 2014
Ingogo is going to provide a card payment service for Xero users.
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 440

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 211

Vote